85.112.40.138 has a low threat confidence level of 25%, originating from Russia, on the Rostelecom network (12389). It has been observed across 51 sessions targeting SMB, First observed on January 25, 2026, most recently active March 6, 2026.